@wentorai/research-plugins 1.4.2 → 1.4.4

package/src/tools/ror.ts

@@ -1,6 +1,6 @@
 import { Type } from "@sinclair/typebox";
 import type { OpenClawPluginApi, OpenClawPluginToolContext } from "openclaw/plugin-sdk";
-import { toolResult, trackedFetch, isTrackedError } from "./util.js";
+import { toolResult, trackedFetch, isTrackedError, validParam } from "./util.js";
 
 const BASE = "https://api.ror.org/v2";
 
@@ -22,9 +22,16 @@ export function createRorTools(
           Type.Number({ description: "Max results (default 10, max 50)" }),
         ),
       }),
-      execute: async (input: { query: string; max_results?: number }) => {
+      execute: async (_toolCallId: string, input: { query: string; max_results?: number }) => {
+        const query = validParam(input?.query);
+        if (!query) {
+          return toolResult({
+            error: "query parameter is required and must not be empty.",
+          });
+        }
+
         const params = new URLSearchParams({
-          query: input.query,
+          query,
         });
 
         const tracked = await trackedFetch("ror", `${BASE}/organizations?${params}`, undefined, 10_000);

package/src/tools/unpaywall.ts

@@ -21,7 +21,7 @@ export function createUnpaywallTools(
           description: "DOI of the paper, e.g. '10.1038/nature12373'",
         }),
       }),
-      execute: async (input: { doi: string }) => {
+      execute: async (_toolCallId: string, input: { doi: string }) => {
         if (!input?.doi) {
           return toolResult({ error: 'doi parameter is required (e.g., "10.1038/nature12373")' });
         }

package/src/tools/util.ts

@@ -150,3 +150,36 @@ export function isTrackedError(
 ): result is ReturnType<typeof toolResult> {
   return "content" in result && "details" in result;
 }
+
+// ── LLM Input Sanitization ──────────────────────────────────────────────
+
+const INVALID_PARAM_VALUES = new Set(["undefined", "null", "none", "None", ""]);
+
+/**
+ * Sanitize an optional string parameter from LLM tool calls.
+ *
+ * LLMs (especially weaker models) sometimes pass the literal string "undefined"
+ * or "null" instead of omitting the parameter. The nullish coalescing operator
+ * (`??`) does NOT catch these because they are truthy strings.
+ *
+ * Returns the value if valid, or `undefined` if it's a known non-value.
+ */
+export function validParam(value: string | undefined | null): string | undefined {
+  if (value == null) return undefined;
+  if (INVALID_PARAM_VALUES.has(value.trim())) return undefined;
+  return value;
+}
+
+/**
+ * Validate a string parameter against a whitelist of allowed values.
+ * Returns the value if it matches, or the fallback otherwise.
+ */
+export function validEnum<T extends string>(
+  value: string | undefined | null,
+  allowed: readonly T[],
+  fallback: T,
+): T {
+  const clean = validParam(value);
+  if (clean && (allowed as readonly string[]).includes(clean)) return clean as T;
+  return fallback;
+}

package/src/tools/zenodo.ts

@@ -1,6 +1,6 @@
 import { Type } from "@sinclair/typebox";
 import type { OpenClawPluginApi, OpenClawPluginToolContext } from "openclaw/plugin-sdk";
-import { toolResult, trackedFetch, isTrackedError } from "./util.js";
+import { toolResult, trackedFetch, isTrackedError, validParam } from "./util.js";
 
 const BASE = "https://zenodo.org/api";
 
@@ -37,20 +37,31 @@ export function createZenodoTools(
           }),
         ),
       }),
-      execute: async (input: {
+      execute: async (_toolCallId: string, input: {
         query: string;
         type?: string;
         size?: number;
         sort?: string;
         access_right?: string;
       }) => {
+        const query = validParam(input?.query);
+        if (!query) {
+          return toolResult({
+            error:
+              "query parameter is required and must not be empty. " +
+              "Example: search_zenodo({ query: \"climate dataset\" })",
+          });
+        }
         const params = new URLSearchParams({
-          q: input.query,
+          q: query,
           size: String(Math.min(input.size ?? 10, 100)),
         });
-        if (input.type) params.set("type", input.type);
-        if (input.sort) params.set("sort", input.sort);
-        if (input.access_right) params.set("access_right", input.access_right);
+        const type = validParam(input.type);
+        if (type) params.set("type", type);
+        const sort = validParam(input.sort);
+        if (sort) params.set("sort", sort);
+        const accessRight = validParam(input.access_right);
+        if (accessRight) params.set("access_right", accessRight);
 
         const result = await trackedFetch("zenodo", `${BASE}/records?${params}`, undefined, 10_000);
         if (isTrackedError(result)) return result;
@@ -102,7 +113,7 @@ export function createZenodoTools(
           description: "Zenodo record ID (numeric), e.g. '7042164'",
         }),
       }),
-      execute: async (input: { record_id: string }) => {
+      execute: async (_toolCallId: string, input: { record_id: string }) => {
         if (!input?.record_id) {
           return toolResult({ error: 'record_id parameter is required (e.g., "1234567")' });
         }